Buggy code:
public class JASPIAuthenticationMechanism implements AuthenticationMechanism { private static final String JASPI_HTTP_SERVLET_LAYER = "HttpServlet" ; private static final String MECHANISM_NAME = "JASPI" ; public static final AttachmentKey < HttpServerExchange > HTTP_SERVER_EXCHANGE_ATTACHMENT_KEY = AttachmentKey . create ( HttpServerExchange . class ) ; public static final AttachmentKey < SecurityContext > SECURITY_CONTEXT_ATTACHMENT_KEY = AttachmentKey . create ( SecurityContext . class ) ; private final String securityDomain ; public JASPIAuthenticationMechanism ( final String securityDomain ) { } @ Override public AuthenticationMechanismOutcome authenticate ( final HttpServerExchange exchange , final SecurityContext securityContext ) { final ServletRequestContext requestContext = exchange . getAttachment ( ATTACHMENT_KEY ) ; final JASPIServerAuthenticationManager sam = createJASPIAuthenticationManager ( ) ; final GenericMessageInfo messageInfo = createMessageInfo ( exchange , securityContext ) ; final String applicationIdentifier = buildApplicationIdentifier ( requestContext ) ; final JASPICallbackHandler cbh = new JASPICallbackHandler ( ) ; UndertowLogger . ROOT_LOGGER . debugf ( "validateRequest<seq2seq4repair_space>for<seq2seq4repair_space>layer<seq2seq4repair_space>[%s]<seq2seq4repair_space>and<seq2seq4repair_space>applicationContextIdentifier<seq2seq4repair_space>[%s]" , JASPIAuthenticationMechanism . JASPI_HTTP_SERVLET_LAYER , applicationIdentifier ) ; if ( sam . isValid ( messageInfo , new Subject ( ) , JASPIAuthenticationMechanism . JASPI_HTTP_SERVLET_LAYER , applicationIdentifier , cbh ) ) { Account account = securityContext . getAuthenticatedAccount ( ) ; if ( account == null ) { UndertowLogger . ROOT_LOGGER . debug ( "Creating<seq2seq4repair_space>account<seq2seq4repair_space>with<seq2seq4repair_space>credentials<seq2seq4repair_space>from<seq2seq4repair_space>JASPI<seq2seq4repair_space>callbackhandler." ) ; account = createAccount ( cbh ) ; <START_BUG> securityContext . authenticationComplete ( account , JASPIAuthenticationMechanism . MECHANISM_NAME ) ; <END_BUG> } else { UndertowLogger . ROOT_LOGGER . debug ( "Account<seq2seq4repair_space>already<seq2seq4repair_space>setup<seq2seq4repair_space>from<seq2seq4repair_space>JASPI<seq2seq4repair_space>modules." ) ; } if ( account == null ) { securityContext . authenticationFailed ( "JASPI<seq2seq4repair_space>authentication<seq2seq4repair_space>failed." , JASPIAuthenticationMechanism . MECHANISM_NAME ) ; } } secureResponse ( exchange , securityContext , sam , messageInfo , cbh ) ; return ( securityContext . getAuthenticatedAccount ( ) ) != null ? AuthenticationMechanismOutcome . AUTHENTICATED : AuthenticationMechanismOutcome . NOT_AUTHENTICATED ; } @ Override public ChallengeResult sendChallenge ( final HttpServerExchange exchange , final SecurityContext securityContext ) { } private boolean isSecureResponse ( final ServletRequestContext attachment , final SecurityContext securityContext ) { } private boolean wasAuthExceptionThrown ( ) { } private JASPIServerAuthenticationManager createJASPIAuthenticationManager ( ) { } private String buildApplicationIdentifier ( final ServletRequestContext attachment ) { } private GenericMessageInfo createMessageInfo ( final HttpServerExchange exchange , final SecurityContext securityContext ) { } private Account createAccount ( final JASPICallbackHandler cbh ) { } private void secureResponse ( final HttpServerExchange exchange , final SecurityContext securityContext , final JASPIServerAuthenticationManager sam , final GenericMessageInfo messageInfo , final JASPICallbackHandler cbh ) { } private Boolean isMandatory ( final ServletRequestContext attachment ) { } }

Fix:
securityContext . authenticationComplete ( account , JASPIAuthenticationMechanism . MECHANISM_NAME , false ) ;